Fix 364

includes/class-wpbdp.php

@@ -523,8 +523,9 @@ public function ajax_listing_submit_image_upload() {
 		if ( ! $listing ) {
 			return $res->send_error( __( 'Invalid listing', 'business-directory-plugin' ) );
 		}
-
-		if ( ! wpbdp_user_is_admin() && ! $listing->owned_by_user( get_current_user_id() ) ) {
+
+		$post_status = get_post_status( $listing_id );
+		if ( 'auto-draft' !== $post_status && ! wpbdp_user_can( 'edit', $listing_id ) ) {
 			return $res->send_error( __( 'You do not have permission to upload images to this listing', 'business-directory-plugin' ) );
 		}
 
@@ -659,7 +660,8 @@ public function ajax_listing_submit_image_delete() {
 			$res->send_error();
 		}
 
-		if ( ! wpbdp_user_can( 'edit', $listing_id ) ) {
+		$post_status = get_post_status( $listing_id );
+		if ( 'auto-draft' !== $post_status && ! wpbdp_user_can( 'edit', $listing_id ) ) {
 			$res->send_error();
 		}
 

includes/controllers/pages/class-submit-listing.php

@@ -563,7 +563,11 @@ private function can_load_existing_listing( $listing_id ) {
 			return true;
 		}
 
-		return wpbdp_user_can( 'edit', $listing_id );
+		if ( wpbdp_user_can( 'edit', $listing_id ) ) {
+			return true;
+		}
+
+		return wpbdp_guest_can_use_access_key();
 	}
 
 	/**
@@ -683,6 +687,11 @@ private function maybe_set_editing() {
 			),
 			'request'
 		);
+
+		if ( ! $listing_id ) {
+			return;
+		}
+
 		$editing_id = wpbdp_get_var(
 			array(
 				'param'    => 'editing',
@@ -692,7 +701,15 @@ private function maybe_set_editing() {
 			'post'
 		);
 
-		$this->editing = $listing_id && $editing_id;
+		if ( $editing_id ) {
+			$this->editing = true;
+			return;
+		}
+
+		$status = get_post_status( $listing_id );
+		if ( $status && 'auto-draft' !== $status ) {
+			$this->editing = true;
+		}
 	}
 
 	/**

includes/helpers/class-authenticated-listing-view.php

@@ -17,18 +17,13 @@ protected function authenticate() {
 			return true;
 		}
 
-		if ( 'WPBDP__Views__Submit_Listing' == get_class( $this ) && empty( $this->editing ) && ! wpbdp_get_option( 'require-login' ) ) {
-			return true;
-		}
-
-		//if ( is_user_logged_in() && ( $this->listing->get_auth ) )
-
-		$key_hash = wpbdp_get_var( array( 'param' => 'access_key_hash' ), 'request' );
-
-		if ( wpbdp_get_option( 'enable-key-access' ) && $key_hash ) {
-			return $this->listing->validate_access_key_hash( $key_hash );
+		if ( class_exists( 'WPBDP__Views__Submit_Listing', false ) && $this instanceof WPBDP__Views__Submit_Listing && empty( $this->editing ) && ! wpbdp_get_option( 'require-login' ) ) {
+			$status = get_post_status( $this->listing->get_id() );
+			if ( ! $status || 'auto-draft' === $status ) {
+				return true;
+			}
 		}
 
-		return false;
+		return wpbdp_request_has_valid_access_key( $this->listing->get_id() );
 	}
 }

includes/helpers/functions/general.php

@@ -348,7 +348,7 @@ function wpbdp_user_can( $action, $listing_id = null, $user_id = null ) {
 		case 'delete':
 			$res = user_can( $user_id, 'edit_others_posts' );
 			$res = $res || ( $user_id && $post->post_author && $post->post_author == $user_id );
-			$res = $res || ( ! $user_id && wpbdp_get_option( 'enable-key-access' ) );
+			$res = $res || ( ! $user_id && wpbdp_request_has_valid_access_key( $listing_id ) );
 			break;
 		default:
 			break;
@@ -360,6 +360,40 @@ function wpbdp_user_can( $action, $listing_id = null, $user_id = null ) {
 	return $res;
 }
 
+/**
+ * Whether the current request includes a valid listing access-key hash.
+ *
+ * @since x.x
+ *
+ * @param int $listing_id Listing ID.
+ *
+ * @return bool
+ */
+function wpbdp_request_has_valid_access_key( $listing_id ) {
+	if ( ! wpbdp_get_option( 'enable-key-access' ) ) {
+		return false;
+	}
+
+	$key_hash = wpbdp_get_var( array( 'param' => 'access_key_hash' ), 'request' );
+	if ( ! $key_hash ) {
+		return false;
+	}
+
+	$listing = wpbdp_get_listing( $listing_id );
+	return $listing && $listing->validate_access_key_hash( $key_hash );
+}
+
+/**
+ * Whether guests may see listing edit/delete links that lead to access-key login.
+ *
+ * @since x.x
+ *
+ * @return bool
+ */
+function wpbdp_guest_can_use_access_key() {
+	return ! is_user_logged_in() && (bool) wpbdp_get_option( 'enable-key-access' );
+}
+
 function wpbdp_get_post_by_slug( $slug, $post_type = null ) {
 	$post_type = $post_type ? $post_type : WPBDP_POST_TYPE;
 

includes/models/class-listing.php

@@ -633,8 +633,7 @@ public function owned_by_user( $user_id = 'current' ) {
 		}
 
 		if ( empty( $user_id ) || ! $this->id ) {
-			// This function is currently intended for logged in users.
-			return true;
+			return false;
 		}
 
 		$post = get_post( $this->id );

templates/parts/listing-buttons.tpl.php

@@ -8,7 +8,7 @@
 $buttons = '';
 
 if ( 'single' === $view || 'excerpt' === $view ) :
-	if ( wpbdp_user_can( 'edit', $listing_id ) ) :
+	if ( wpbdp_user_can( 'edit', $listing_id ) || wpbdp_guest_can_use_access_key() ) :
 		$buttons .= sprintf(
 			'<a class="button wpbdp-button edit-listing" href="%s" rel="nofollow">%s</a>',
 			wpbdp_url( 'edit_listing', $listing_id ),
@@ -24,7 +24,7 @@
 		);
 	endif;
 
-	if ( wpbdp_user_can( 'delete', $listing_id ) ) :
+	if ( wpbdp_user_can( 'delete', $listing_id ) || wpbdp_guest_can_use_access_key() ) :
 		$buttons .= sprintf(
 			'<a class="button wpbdp-button delete-listing" href="%s" rel="nofollow">%s</a>',
 			wpbdp_url( 'delete_listing', $listing_id ),

templates/submit-listing-images-single.tpl.php

@@ -7,14 +7,17 @@
 	$caption  = $image->caption;
 }
 
-$delete_link = add_query_arg(
-	array(
-		'action'     => 'wpbdp-listing-submit-image-delete',
-		'image_id'   => $image_id,
-		'listing_id' => $listing_id,
-	),
-	admin_url( 'admin-ajax.php' )
+$delete_args = array(
+	'action'     => 'wpbdp-listing-submit-image-delete',
+	'image_id'   => $image_id,
+	'listing_id' => $listing_id,
 );
+$key_hash    = wpbdp_get_var( array( 'param' => 'access_key_hash' ), 'request' );
+if ( $key_hash ) {
+	$delete_args['access_key_hash'] = $key_hash;
+}
+
+$delete_link = add_query_arg( $delete_args, admin_url( 'admin-ajax.php' ) );
 $delete_link = wp_nonce_url( $delete_link, 'delete-listing-' . $listing_id . '-image-' . $image_id );
 ?>
 

templates/submit-listing-images-upload-form.tpl.php

@@ -2,18 +2,30 @@
 $admin      = isset( $admin ) ? $admin : false;
 $listing_id = isset( $listing_id ) ? $listing_id : 0;
 
+$ajax_args = array(
+	'listing_id' => $listing_id,
+);
+$key_hash  = wpbdp_get_var( array( 'param' => 'access_key_hash' ), 'request' );
+if ( $key_hash ) {
+	$ajax_args['access_key_hash'] = $key_hash;
+}
+
 $action = add_query_arg(
-	array(
-		'action'     => 'wpbdp-listing-submit-image-upload',
-		'listing_id' => $listing_id,
+	array_merge(
+		$ajax_args,
+		array(
+			'action' => 'wpbdp-listing-submit-image-upload',
+		)
 	),
 	admin_url( 'admin-ajax.php' )
 );
 
 $media_action = add_query_arg(
-	array(
-		'action'     => 'wpbdp-listing-media-image',
-		'listing_id' => $listing_id,
+	array_merge(
+		$ajax_args,
+		array(
+			'action' => 'wpbdp-listing-media-image',
+		)
 	),
 	admin_url( 'admin-ajax.php' )
 );